PT-2014-8550 · Linux+1 · Linux Kernel+1

Published 2014-11-10 · Updated 2016-11-28 · CVE-2014-8480

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.18-rc2

Description The issue is related to the instruction decoder in the KVM subsystem of the Linux kernel. It lacks intended decoder-table flags for certain RIP-relative instructions, allowing guest OS users to cause a denial of service. This can be achieved by a crafted application, resulting in a NULL pointer dereference and a host OS crash.

Recommendations For versions prior to 3.18-rc2, update to version 3.18-rc2 or later to resolve the issue.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2014-2452

ALT-PU-2015-1794

CVE-2014-8480

Affected Products

Alt Linux

Linux Kernel

References · 361

• 🔥 https://github.com/torvalds/linux/commit/3f6f1480d86bf9fc16c160d803ab1d006e3058d5 · Exploit
• 🔥 https://github.com/retme7/CVE-2014-4322_poc · Exploit
• 🔥 https://github.com/panyu6325/CVE-2015-1805 · Exploit
• 🔥 https://github.com/laginimaineb/cve-2014-4322 · Exploit
• 🔥 https://github.com/marcograss/cve-2014-4323 · Exploit
• 🔥 https://github.com/FloatingGuy/cve-2015-1805 · Exploit
• 🔥 https://github.com/ireshchaminda1/Android-Privilege-Escalation-Remote-Access-Vulnerability-CVE-2015-1805 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2014/10/23/7 · Exploit
• 🔥 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3f6f1480d86bf9fc16c160d803ab1d006e3058d5 · Exploit
• https://bdu.fstec.ru/vul/2015-05757 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3182 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2041 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9803 · Security Note
• https://bdu.fstec.ru/vul/2015-05724 · Security Note
• https://bdu.fstec.ru/vul/2015-05747 · Security Note